paulmataruso/main
1
0
Fork 0
mirror of https://github.com/socfortress/Wazuh-Rules.git synced 2025-11-04 05:43:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Create 100610-domain_stats_rules.xml

Browse Source
This commit is contained in:
SOCFortress
2022-08-08 16:41:22 -05:00
committed by GitHub
parent 1ecb82dbd4
commit 62405ff7c4
1 changed files with 56 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
Domain Stats/100610-domain_stats_rules.xml Normal file
View File

@@ -0,0 +1,56 @@
<group name="dnsstat,">
<rule id="100610" level="5">
<field name="integration">dnsstat</field>
<description>DNS Stats</description>
<options>no_full_log</options>
<group>dnsstat_alert,</group>
</rule>
<rule id="100611" level="5">
<if_sid>100610</if_sid>
<field name="dnsstat.alerts">LOW-FREQ-SCORES|SUSPECT-FREQ-SCORE</field>
<description>DNS Stats - Low Frequency Score in Queried Domain</description>
<mitre>
<id>T1071</id>
</mitre>
<options>no_full_log</options>
<group>dnsstat_alert,</group>
</rule>
<rule id="100612" level="5">
<if_sid>100610</if_sid>
<field name="dnsstat.alerts">YOUR-FIRST-CONTACT</field>
<description>DNS Stats - Domain Queried for the first time</description>
<mitre>
<id>T1071</id>
</mitre>
<options>no_full_log</options>
<group>dnsstat_alert,</group>
</rule>
<rule id="100613" level="5">
<if_sid>100610</if_sid>
<field name="dnsstat.category">NEW</field>
<description>DNS Stats - DNS Query to Recently Created Domain</description>
<mitre>
<id>T1071</id>
</mitre>
<options>no_full_log</options>
<group>dnsstat_alert,</group>
</rule>
<rule id="100614" level="5">
<if_sid>100610</if_sid>
<field name="dnsstat.error">\.+</field>
<description>DNS Stats - Error connecting to API</description>
<options>no_full_log</options>
<group>dnsstat_error,</group>
</rule>
<rule id="100615" level="5">
<if_sid>100610</if_sid>
<field name="dnsstat.category">ERROR</field>
<description>DNS Stats - RDAP Error Querying Domain</description>
<mitre>
<id>T1071</id>
</mitre>
<options>no_full_log</options>
<group>dnsstat_error,</group>
</rule>
</group>